JP2012037948A - Method for changing device setting - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a method for changing device setting which detects that a computer with a less secure password is connected to a network and automatically changes the less secure password to a highly secure password.SOLUTION: The invention includes a network connection detection function to detect that a computer is connected to a network according to an inventory DB, a password inspection function to detect an account with a less secure password which is contained in an inspection account list and an inspection password list, and an automatic password changing function to automatically change the password of the account to a highly secure password and store the information in an altered account DB. It also includes a management function to notify the administrator of the account that the password is changed and provide the administrator with information on the altered account DB through a management interface.

Description

  The present invention relates to a technique for changing usage conditions used for use of equipment including a computer, in particular, information for maintaining its safety such as a password.

  Currently, the use of networks is expanding due to the spread of the Internet and the like. Along with this, there is a crisis through the network such as virus distribution. For this reason, several techniques for improving security have been proposed.

  Japanese Patent Application Laid-Open No. 2004-133620 proposes a method for easily executing a security inspection by expanding a general security scanner function of detecting a computer to which a security patch is not applied or a computer having a poor security setting. Furthermore, Patent Document 2 proposes a method and a program for detecting an intrusion route unique to a target system and performing a security diagnosis based on the detected intrusion route. Further, Patent Document 3 proposes a security management system in which filtering rules are added and defended until a security patch is provided in order to prevent unauthorized access. In Non-Patent Documents 1 and 2, a security problem is raised.

Published Japanese Patent Laid-Open No. 2001-337919 Published JP 2008-2557577 Published JP 2009-37651

Http://www.ipa.go.jp/security/txt/2009/12outline.html Report Status of Computer Virus / Unauthorized Computer Access [for November] Http://www.ipa.go.jp/security/txt/2010/03outline.html About the report status [for February] of computer viruses and unauthorized access

  Computers connected to the network are always at risk of damage from unauthorized access. There have been many reports of cases where computers connected to the Internet were hacked by password cracking. Password cracking is a method of brute force attack and dictionary attack by analyzing and finding another person's password, and there are programs for attacking. According to a document published by the Security Center of the Information Processing Promotion Organization, damage cases that have been intruded into the server because the administrator password was easy to guess (Non-Patent Document 1) It is warned that simple passwords are guessed and monetary damage continues (Non-Patent Document 2).

  On the other hand, with the conventional technology, only the inspection result of the security hole diagnosis is displayed, and there is a problem that correction of deficiencies must be performed manually by the administrator based on the inspection result ( Patent Document 1). Further, it is assumed that security hole diagnosis is performed as an individual event, and there is a problem that it is impossible to constantly monitor the network and find and correct deficiencies (Patent Document 2). In the technique of temporarily protecting a security hole for which a security patch is not provided with a filtering rule, there is a problem that password cracking cannot be prevented (Patent Document 3).

  Therefore, according to the present invention, a security use condition in which a start of use of a device such as a computer connected to a network is detected and a low-strength password that can be easily guessed for the device is set is predetermined. Audit whether there is an account that does not meet the standards, and change to a use condition that satisfies the predetermined standards for security.

  In order to realize this, the following functions (programs) may be used. Network interface, memory, CPU, audit account list that records information of audited accounts, audit password list that records information of passwords to be audited, corrected account DB that records forcedly changed accounts and their passwords, to this system It consists of a management DB that records information for logging in, and an inventory DB that records information about computers connected to the network. It consists of a network connection detection function, a password audit function, a forced password change function, and a management function. It has two control functions.

The audit account list is recorded with a list of accounts to be audited, and the audit password list is recorded with a list of passwords to be audited.
The corrected account DB is a database including date and time, IP address, MAC address, protocol, account, password before correction, and password after correction.

  The management DB is a database including an administrator name and a hashed password.

  The inventory DB is a database including the last confirmation date, IP address, and MAC address.

  It becomes possible to take security measures for devices including computers more easily.

The system block diagram of the password audit correction system of one Embodiment of this invention. The flowchart which shows operation | movement of the password audit correction system of one Embodiment of this invention. The figure which shows the format of the audit account list used by one Embodiment of this invention. The figure which shows the format of the audit password list | wrist used by one Embodiment of this invention. The figure which shows the specification of corrected account DB used by one Embodiment of this invention. The figure which shows the specification of management DB used by one Embodiment of this invention. The figure which shows the specification of inventory DB of this invention.

Embodiments of the present invention will be described below with reference to the drawings.
FIG. 1 is a system configuration diagram showing an embodiment of the present invention. The password audit correction system 110 includes a network interface 111, a memory 112, a CPU 113, an audit account list 114, an audit password list 115, a corrected account DB 116, a management DB 117, an inventory DB 118, and a network connection detection function 119, When the password audit function 120, forced password change function 121, and control function of the management function 122 detect that the computer 100 to be audited is connected to the network 130, password audit is performed, and a weak password is set Is configured to automatically change passwords. Each of these functions can be realized by a computer program. That is, each of these functions is processed by an arithmetic device such as a CPU according to this program.

The audit account list 114 records a list of accounts to be audited, and general account names such as “administrator”, “guest”, and “root” are registered. In the audit password list 115, a list of passwords to be audited is recorded, and low-strength passwords such as “1234”, “password”, and “passwd” are registered. The corrected account DB 116 is a database composed of date / time, IP address, MAC address, protocol, account, password before correction, and password after correction. The management DB 117 is a database composed of an administrator name and a hashed password. The inventory DB 118 is a database composed of the last confirmation date, IP address, and MAC address.
The network connection detection function 119 is configured to periodically transmit an ARP packet in order to detect that a new computer is connected to the same network. ARP packets can be used to detect computers that do not accept ICMP echo requests (Ping) because the personal firewall is enabled.

The password audit function 120 implements protocols such as SSH and Telnet that can log in to the system remotely, and is configured to be able to remotely audit passwords using the audit account list 114 and the audit password list DB 115.
The forced password change function 121 is configured to randomly generate a strong password and change the password remotely. The management function 122 is configured to notify the administrator that a low-strength password has been detected by means of e-mail or the like, and display the contents of the corrected account DB 116 after authentication. Note that the strength is preferably determined by comparison with a rule (reference) stored in advance. For example, it is determined whether the repetition of the same symbol / character is determined to be low and whether the actual registration is applicable. In addition, the user's personal information (attributes) such as birthday and name is memorized, and it may be judged whether it applies to this, or based on the password set in the past (within a certain period) Also good. In addition, since it is determined that the password itself has a clear meaning, it may be determined by comparing with a word stored in a dictionary DB (not shown).

Next, the operation of the password audit correction system 110 configured as described above will be described.
FIG. 2 is a flowchart showing the operation of the password audit correction system 110.

The password audit correction system 110 transmits an ARP packet at regular intervals by the network connection detection function 119 (S201).
If an ARP packet response is received, the inventory DB is searched, and if there is no matching record, it is determined that the computer is a new computer. Even if a record exists in the DB, it is determined that the computer is a new computer if the MAC address is different (S202).

  If new computers are detected, the password audit function 120 is started for each detected computer. The audit account list 114 and the audit password list DB 115 are read, and a password audit is executed using a combination thereof. The password audit function 120 is implemented with a protocol such as SSH or Telnet that allows remote login to the system (S211) (S212) (S213).

When the password audit is completed, the computer is registered in the inventory DB (S214).
When an account that matches both the account list and the password list is found in the password audit, it is determined that the password is weak, and the forced password change function 121 is started, and a strong password is randomly generated. The password to be set is generated based on parameters such as a preset length, characters to be used, combinations of numbers, letters and symbols. If a plurality of accounts are found, different passwords are generated (S221). In this case, a password may be generated so as to avoid the above-mentioned “low”, or a DB (table) storing a “high” password that is avoided is prepared, and extracted randomly or in a predetermined order from this You may make it do.

The password is remotely changed with the generated password (S222).
Try logging in and see if the password change was successful. If login is successful with the corrected password, it is determined that the password change is successful (S223).

  When the password change is successful, the date / time, IP address, MAC address, protocol, account, password before correction, and password after correction are recorded in the corrected account DB 116 (S224).

The management function 122 notifies the administrator by e-mail that the password change has succeeded or failed (S231).
The management function 122 performs authentication using the management DB 117. If the authentication is successful, the contents of the corrected account DB 116 are displayed and the system is maintained as necessary. (S232)

100 Computer to be audited 110 Password audit correction system 111 Network interface 112 Memory 113 CPU
114 Audit Account List 115 Audit Password List 116 Corrected Account DB
117 Management DB
118 Inventory DB
119 Network connection detection function 120 Password audit function 121 Forced password change function 122 Management function 130 Network

Claims (6)

In the usage condition change method to change the security usage conditions of the device,
When the start of use of the device is detected, the set use condition of the device is specified,
Determining whether the use conditions satisfy a predetermined standard;
If the criterion is not satisfied as a result of the determination, the usage condition changing method is characterized in that the set usage condition is changed to a usage condition that satisfies the criterion. In the usage condition changing method according to claim 1,
The device is a computer connected to a network,
A management device for managing the network;
When the computer is connected to the network, the usage conditions are specified,
The use condition changing method according to claim 1, wherein as the determination, a determination is made as to whether a connection criterion for connection to the network is satisfied. In the usage condition changing method according to claim 2,
The management device
For each account that identifies each device connected to the network and that is the management target of the management device, a database storing usage conditions of the device is stored,
A usage condition changing method, wherein the usage conditions are specified and determined when an account stored in the database is connected to the network. In the usage condition changing method according to claim 3,
The use condition changing method, wherein the management device records an account in which the change is performed in the database. In the usage condition changing method according to any one of claims 1 to 4,
The use condition changing method, wherein the use condition is a password. In the usage condition changing method according to claim 5,
Remember passwords that do not meet the criteria,
The use condition changing method, wherein the determination is performed by comparing the password with a set password.

Images